Security

• Site keys are random secrets prefixed bk_live_, stored as SHA-256 hashes and verified by hash on every request.
• Form Capture keys are secret and expected only on servers. Engage keys are publishable and constrained by the per-site origin lock.
• Planned credential replacement supports explicit staging and retirement. Emergency rotation and revocation immediately deny the affected key.
• Console access is tied to your Buckhy account; site owners see only their own sites, keys and records.

• All endpoints are HTTPS only.
• api.buckhy.com accepts browser requests only from Buckhy's own applications; a Form Capture call from any other origin fails the CORS preflight.
• Engage answers browser requests only for the origins you register per site; any other origin receives 403 origin not allowed for this site. Its CORS headers reflect the single calling origin, never *.

• Every delivery is signed with HMAC-SHA256 over timestamp.rawBody using the secret you set. Verify in constant time and reject stale timestamps — see Verify the signature.
• Deliveries carry X-Buckhy-Engage-Event so you can route before parsing.
• 4xx responses are never retried; 5xx and timeouts are retried up to 3 times.

• Engage sets no cookies and loads no third-party scripts. It keeps a random visitor token — and, in email identity mode, the visitor's email — in the browser's localStorage for that origin only.
• Managed Forms strips common honeypot fields (website, url, homepage) before storing.
• Form Capture stores exactly the fields you send. When you send context.ip, the raw address is kept for 30 days and then removed; the derived country and device label remain.
• Knowledge packs stay on the server. Visitors receive answers and citations, never the pack.
• Alert emails go only to the notify address you configured per site.

Email developers@buckhy.com with the endpoint, steps to reproduce and the impact you observed. Please do not test against other customers' sites or data. We acknowledge reports within two business days.